Virus - Expert said it is probably Smitfraud and Vundo

omgmizzle · 01-13-2008, 03:07 PM

Here is what is happening:
-false antivirus program popups, stemming from a false windows taskbar warning saying "You have a bad virus, click here to resolve"
-constant popups of antivirus programs (false ones, mind you)
-contant Spybot popups saying "Browser Helper Object Change: Allow or Deny", which shows it IS doing it's job
-all system restore points have been deleted
-a program called Outerinfo installed itself, when we uninstalled it, you could no longer have access to the Control Panel/Program Defaults links from the Start bar

We have the following programs to combat problems (relevant/unrelevant):
-Spybot Search & Destroy
-Ad-Aware 2007 & other previous version
-CCcleaner
-Registry Cleaner
-The Ultimate Troubleshooter

Yet, we've scanned with all these and found nothing. It must be a really smart virus!

So tell me, what do we do, short of clearing everything off and starting anew, which is our only other option, unless there's something you can do to help!

**Glaswegian** · 01-13-2008, 03:23 PM

Hi and welcome to TSF.

Please start here and follow the instructions.

http://www.techsupportforum.com/secu...sting-log.html

If you cannot complete any of the Steps, simply move on to the next one - remember to let the Analyst know about this when you post your logs.

Do not post your logs back in this thread - follow the guidance in the above link!

Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply.

omgmizzle · 01-13-2008, 09:00 PM

Just wanted to let you know:
I found a lot of anti-Microsoft security viruses, along with Smitfraud, Vundo, Virtumonde, Clickspring.Outerinfo, Cool Toolbar, Nous-Tech, SurfAccuracy, and a few win32 viruses. They have all been removed by Spybot. The virus (Vundo, I'm assuming) still keeps appearing, and VundoFix shows one file that just can not be deleted. Also, our "temp" file keeps showing up with win(random number) files, approximately 2,000; last time I checked. Beyond that, we are now unable to get to control panel, through start or the system32 folder.

Vundofix shows many bad viruses in the system32 file, including one that will not be removed, however many scans and removals we do (we've done about 20 so far). Is there any way we can stop this/remove the file/do something for the issue? The file is hppfecb.dll (or very, very close to that, I don't have the paper that I wrote it down on).

If there's any way somebody can help with this, that would help.

Ried · 01-13-2008, 09:32 PM

Yes, we can remove those properly for you.

Click the link Glaswegian provided you with, please follow the instructions given there. Do not post your logs here, post them in the HijackThis Log Help section.

omgmizzle · 01-13-2008, 10:04 PM

1. Cannot do step 1 because I do not have access to the Control Panel. The virus did that
2. Cannot do step 2 because I do not have Internet Explorer installed, and am using Firefox, and the pandascan thing only uses IE. We had to uninstall because of the virus.
3. Installed SpywareBlaster and scanned, made sure EVERYTHING was protected. Done
4. Cannot download because IE is cleared off our computer, and has errors on it. We would prefer it to stay that way until all viruses are cleared.
5. Cannot run DSS because we are in Safe Mode, to prevent viruses from further attacking the system.

I am posting my HijackThis log into the HT forum. Thank you

Ried · 01-13-2008, 11:28 PM

We'll continue in your HijackThis Log Help thread.

01-13-2008, 03:07 PM	#1 (permalink)
omgmizzle Registered User Join Date: Jan 2008 Posts: 71 OS: Windows Vista	Virus - Expert said it is probably Smitfraud and Vundo Here is what is happening: -false antivirus program popups, stemming from a false windows taskbar warning saying "You have a bad virus, click here to resolve" -constant popups of antivirus programs (false ones, mind you) -contant Spybot popups saying "Browser Helper Object Change: Allow or Deny", which shows it IS doing it's job -all system restore points have been deleted -a program called Outerinfo installed itself, when we uninstalled it, you could no longer have access to the Control Panel/Program Defaults links from the Start bar We have the following programs to combat problems (relevant/unrelevant): -Spybot Search & Destroy -Ad-Aware 2007 & other previous version -CCcleaner -Registry Cleaner -The Ultimate Troubleshooter Yet, we've scanned with all these and found nothing. It must be a really smart virus! So tell me, what do we do, short of clearing everything off and starting anew, which is our only other option, unless there's something you can do to help!

01-13-2008, 03:23 PM	#2 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,482 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	Re: Virus - Expert said it is probably Smitfraud and Vundo Hi and welcome to TSF. Please start here and follow the instructions. http://www.techsupportforum.com/secu...sting-log.html If you cannot complete any of the Steps, simply move on to the next one - remember to let the Analyst know about this when you post your logs. Do not post your logs back in this thread - follow the guidance in the above link! Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner

01-13-2008, 09:00 PM	#3 (permalink)
omgmizzle Registered User Join Date: Jan 2008 Posts: 71 OS: Windows Vista	Re: Virus - Expert said it is probably Smitfraud and Vundo Just wanted to let you know: I found a lot of anti-Microsoft security viruses, along with Smitfraud, Vundo, Virtumonde, Clickspring.Outerinfo, Cool Toolbar, Nous-Tech, SurfAccuracy, and a few win32 viruses. They have all been removed by Spybot. The virus (Vundo, I'm assuming) still keeps appearing, and VundoFix shows one file that just can not be deleted. Also, our "temp" file keeps showing up with win(random number) files, approximately 2,000; last time I checked. Beyond that, we are now unable to get to control panel, through start or the system32 folder. Vundofix shows many bad viruses in the system32 file, including one that will not be removed, however many scans and removals we do (we've done about 20 so far). Is there any way we can stop this/remove the file/do something for the issue? The file is hppfecb.dll (or very, very close to that, I don't have the paper that I wrote it down on). If there's any way somebody can help with this, that would help.

01-13-2008, 09:32 PM	#4 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,962 OS: WinXP and Vista	Re: Virus - Expert said it is probably Smitfraud and Vundo Yes, we can remove those properly for you. Click the link Glaswegian provided you with, please follow the instructions given there. Do not post your logs here, post them in the HijackThis Log Help section. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

01-13-2008, 10:04 PM	#5 (permalink)
omgmizzle Registered User Join Date: Jan 2008 Posts: 71 OS: Windows Vista	Re: Virus - Expert said it is probably Smitfraud and Vundo 1. Cannot do step 1 because I do not have access to the Control Panel. The virus did that 2. Cannot do step 2 because I do not have Internet Explorer installed, and am using Firefox, and the pandascan thing only uses IE. We had to uninstall because of the virus. 3. Installed SpywareBlaster and scanned, made sure EVERYTHING was protected. Done 4. Cannot download because IE is cleared off our computer, and has errors on it. We would prefer it to stay that way until all viruses are cleared. 5. Cannot run DSS because we are in Safe Mode, to prevent viruses from further attacking the system. I am posting my HijackThis log into the HT forum. Thank you

01-13-2008, 11:28 PM	#6 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,962 OS: WinXP and Vista	Re: Virus - Expert said it is probably Smitfraud and Vundo We'll continue in your HijackThis Log Help thread. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."